“Check the address” is advice everyone repeats and almost nobody explains. There is one specific place to look — and once you know it, the fakes fall apart on their own.
Where the real domain sits
Take an address and break it apart:
In https://mybank.com.secure-login.net/signin the real domain is secure-login.net; “mybank.com” is just part of a name someone wrote to the left of it. Everything further left is freely made up.
Read an address right to left up to the first slash. The last two parts before it are whoever owns the page.
The tricks in use
| Trick | How it looks | What to check |
|---|---|---|
| A familiar name on the left | bank.com.login-portal.net | The part before the first slash |
| Look-alike letters | A Cyrillic “а” standing in for a Latin one | The address looks right, the domain is different |
| An extra character | my-bank.com, mybannk.com | A hyphen, a doubled letter, one letter swapped |
| A different zone | name.co instead of name.com | The zone is part of the domain, not a detail |
| A shortened link | A short address from an unknown service | You cannot see the destination before opening it |
| Swapped link text | It says one thing and leads to another | Hover and read the status bar |
Checking in practice
-
On a computer — hover
The real address appears in the status bar at the bottom. The link text may say anything at all.
-
On a phone — long press
The full address pops up. This is the only way to see it before opening.
-
Read right to left
Up to the first single slash. If the name there is unfamiliar, there is nothing more to work out.
-
Type it yourself instead of clicking
The most reliable move and the most underrated one. Opening a site from a bookmark or typing the address takes seconds and settles the question entirely.
For what a whole fake page looks like and what to do after typing a password into one, see phishing. For codes in the street, see fake QR codes.